diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-06-28 21:03:59 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-07-14 22:17:43 +0200 |
| commit | 62d10ec35c3055a153b08f51d844932f19ed66e7 (patch) | |
| tree | 31e83d80e1dee155b7c1c20599f74ddaae98e87f /libavformat | |
| parent | 84669b1872269a458266b63005cade9788a00a64 (diff) | |
| download | ffmpeg-62d10ec35c3055a153b08f51d844932f19ed66e7.tar.gz | |
avformat/vividas: Fixes overflow in shift in recover_key()
Fixes: left shift of 133 by 24 places cannot be represented in type 'int'
Fixes: 15365/clusterfuzz-testcase-minimized-ffmpeg_DEMUXER_fuzzer-5716153105645568
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Suggested-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/vividas.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/libavformat/vividas.c b/libavformat/vividas.c index 350c7aa70a..830e318645 100644 --- a/libavformat/vividas.c +++ b/libavformat/vividas.c @@ -115,10 +115,7 @@ static unsigned recover_key(unsigned char sample[4], unsigned expected_size) put_v(plaintext+2, expected_size); - return (sample[0]^plaintext[0])| - ((sample[1]^plaintext[1])<<8)| - ((sample[2]^plaintext[2])<<16)| - ((sample[3]^plaintext[3])<<24); + return AV_RL32(sample) ^ AV_RL32(plaintext); } static void xor_block(void *p1, void *p2, unsigned size, int key, unsigned *key_ptr) |